diff mbox series

[v4,08/11] xen/compiler: import 'fallthrough' keyword from linux

Message ID aab15a158f6acb5f5a1cfd0dad1d4493b1fcace9.1610115608.git.rahul.singh@arm.com (mailing list archive)
State Superseded
Headers show
Series xen/arm: Add support for SMMUv3 driver | expand

Commit Message

Rahul Singh Jan. 8, 2021, 2:46 p.m. UTC
-Wimplicit-fallthrough warns when a switch case falls through. Warning
can be suppress by either adding a /* fallthrough */ comment, or by
using a null statement: __attribute__ ((fallthrough))

Define the pseudo keyword 'fallthrough' for the ability to convert the
various case block /* fallthrough */ style comments to null statement
"__attribute__((__fallthrough__))"

In C mode, GCC supports the __fallthrough__ attribute since 7.1,
the same time the warning and the comment parsing were introduced.

fallthrough devolves to an empty "do {} while (0)" if the compiler
version (any version less than gcc 7) does not support the attribute.

Signed-off-by: Rahul Singh <rahul.singh@arm.com>
---
Changes in V4:
 - This patch is introduce in this verison.
---
 xen/include/xen/compiler.h | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

Comments

Stefano Stabellini Jan. 9, 2021, 1:44 a.m. UTC | #1
On Fri, 8 Jan 2021, Rahul Singh wrote:
> -Wimplicit-fallthrough warns when a switch case falls through. Warning
> can be suppress by either adding a /* fallthrough */ comment, or by
> using a null statement: __attribute__ ((fallthrough))
> 
> Define the pseudo keyword 'fallthrough' for the ability to convert the
> various case block /* fallthrough */ style comments to null statement
> "__attribute__((__fallthrough__))"
> 
> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
> the same time the warning and the comment parsing were introduced.
> 
> fallthrough devolves to an empty "do {} while (0)" if the compiler
> version (any version less than gcc 7) does not support the attribute.
> 
> Signed-off-by: Rahul Singh <rahul.singh@arm.com>
> ---
> Changes in V4:
>  - This patch is introduce in this verison.
> ---
>  xen/include/xen/compiler.h | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/xen/include/xen/compiler.h b/xen/include/xen/compiler.h
> index e643e69128..0ec0b4698e 100644
> --- a/xen/include/xen/compiler.h
> +++ b/xen/include/xen/compiler.h
> @@ -33,6 +33,22 @@
>  #define unreachable() __builtin_unreachable()
>  #endif
>  
> +/*
> + * Add the pseudo keyword 'fallthrough' so case statement blocks
> + * must end with any of these keywords:
> + *   break;
> + *   fallthrough;
> + *   goto <label>;
> + *   return [expression];
> + *
> + *  gcc: https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html#Statement-Attributes
> + */
> +#if (!defined(__clang__) && (__GNUC__ >= 7))
> +# define fallthrough        __attribute__((__fallthrough__))
> +#else
> +# define fallthrough        do {} while (0)  /* fallthrough */
> +#endif
> +
>  #ifdef __clang__
>  /* Clang can replace some vars with new automatic ones that go in .data;
>   * mark all explicit-segment vars 'used' to prevent that. */

It would be nicer to use __has_attribute to check if fallthrough is
supported by the compiler, but I wouldn't want to have to implement
__has_attribute by hand for the old compilers that don't have it. If we
are in doubt whether the compiler has has_attribute or not, then I think
it is better to do what you did here and avoid the problem altogether.


Linux states:

 * __has_attribute is supported on gcc >= 5, clang >= 2.9 and icc >= 17.


Unfortunately gcc 4.9 is old but still around. I don't think we made any
statements in Xen about gcc support >= 5. Hence, I think your patch is
good as it is.


Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Bertrand Marquis Jan. 12, 2021, 11:36 a.m. UTC | #2
Hi,

> On 8 Jan 2021, at 14:46, Rahul Singh <Rahul.Singh@arm.com> wrote:
> 
> -Wimplicit-fallthrough warns when a switch case falls through. Warning
> can be suppress by either adding a /* fallthrough */ comment, or by
> using a null statement: __attribute__ ((fallthrough))
> 
> Define the pseudo keyword 'fallthrough' for the ability to convert the
> various case block /* fallthrough */ style comments to null statement
> "__attribute__((__fallthrough__))"
> 
> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
> the same time the warning and the comment parsing were introduced.
> 
> fallthrough devolves to an empty "do {} while (0)" if the compiler
> version (any version less than gcc 7) does not support the attribute.
> 
> Signed-off-by: Rahul Singh <rahul.singh@arm.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>

Cheers
Bertrand

> ---
> Changes in V4:
> - This patch is introduce in this verison.
> ---
> xen/include/xen/compiler.h | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
> 
> diff --git a/xen/include/xen/compiler.h b/xen/include/xen/compiler.h
> index e643e69128..0ec0b4698e 100644
> --- a/xen/include/xen/compiler.h
> +++ b/xen/include/xen/compiler.h
> @@ -33,6 +33,22 @@
> #define unreachable() __builtin_unreachable()
> #endif
> 
> +/*
> + * Add the pseudo keyword 'fallthrough' so case statement blocks
> + * must end with any of these keywords:
> + *   break;
> + *   fallthrough;
> + *   goto <label>;
> + *   return [expression];
> + *
> + *  gcc: https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html#Statement-Attributes
> + */
> +#if (!defined(__clang__) && (__GNUC__ >= 7))
> +# define fallthrough        __attribute__((__fallthrough__))
> +#else
> +# define fallthrough        do {} while (0)  /* fallthrough */
> +#endif
> +
> #ifdef __clang__
> /* Clang can replace some vars with new automatic ones that go in .data;
>  * mark all explicit-segment vars 'used' to prevent that. */
> -- 
> 2.17.1
>
Jan Beulich Jan. 12, 2021, 11:41 a.m. UTC | #3
On 08.01.2021 15:46, Rahul Singh wrote:
> -Wimplicit-fallthrough warns when a switch case falls through. Warning
> can be suppress by either adding a /* fallthrough */ comment, or by
> using a null statement: __attribute__ ((fallthrough))

Why is the comment variant (which we use in many places already,
albeit with varying wording) not the route of choice?

> Define the pseudo keyword 'fallthrough' for the ability to convert the
> various case block /* fallthrough */ style comments to null statement
> "__attribute__((__fallthrough__))"
> 
> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
> the same time the warning and the comment parsing were introduced.
> 
> fallthrough devolves to an empty "do {} while (0)" if the compiler
> version (any version less than gcc 7) does not support the attribute.

What about Coverity? It would be nice if we wouldn't need to add
two separate constructs everywhere to make both compiler and static
code checker happy.

Jan
Stefano Stabellini Jan. 12, 2021, 11:30 p.m. UTC | #4
On Tue, 12 Jan 2021, Jan Beulich wrote:
> On 08.01.2021 15:46, Rahul Singh wrote:
> > -Wimplicit-fallthrough warns when a switch case falls through. Warning
> > can be suppress by either adding a /* fallthrough */ comment, or by
> > using a null statement: __attribute__ ((fallthrough))
> 
> Why is the comment variant (which we use in many places already,
> albeit with varying wording) not the route of choice?

See previous discussion:

https://marc.info/?l=xen-devel&m=160707274517270
https://marc.info/?l=xen-devel&m=160733742810605
https://marc.info/?l=xen-devel&m=160733852011023

We thought it would be best to introduce "fallthrough" and only resort
to comments as a plan B. The usage of the keyword should allow GCC to do
better checks.


> > Define the pseudo keyword 'fallthrough' for the ability to convert the
> > various case block /* fallthrough */ style comments to null statement
> > "__attribute__((__fallthrough__))"
> > 
> > In C mode, GCC supports the __fallthrough__ attribute since 7.1,
> > the same time the warning and the comment parsing were introduced.
> > 
> > fallthrough devolves to an empty "do {} while (0)" if the compiler
> > version (any version less than gcc 7) does not support the attribute.
> 
> What about Coverity? It would be nice if we wouldn't need to add
> two separate constructs everywhere to make both compiler and static
> code checker happy.

I don't think I fully understand your reply here: Coverity doesn't come
into the picture. Given that GCC provides a special keyword to implement
fallthrough, it makes sense to use it when available. When it is not
available (e.g. clang or older GCC) we need to have an alternative to
suppress the compiler warnings. Hence the need for this check:

  #if (!defined(__clang__) && (__GNUC__ >= 7))
Stefano Stabellini Jan. 12, 2021, 11:40 p.m. UTC | #5
On Tue, 12 Jan 2021, Stefano Stabellini wrote:
> On Tue, 12 Jan 2021, Jan Beulich wrote:
> > On 08.01.2021 15:46, Rahul Singh wrote:
> > > -Wimplicit-fallthrough warns when a switch case falls through. Warning
> > > can be suppress by either adding a /* fallthrough */ comment, or by
> > > using a null statement: __attribute__ ((fallthrough))
> > 
> > Why is the comment variant (which we use in many places already,
> > albeit with varying wording) not the route of choice?
> 
> See previous discussion:
> 
> https://marc.info/?l=xen-devel&m=160707274517270
> https://marc.info/?l=xen-devel&m=160733742810605
> https://marc.info/?l=xen-devel&m=160733852011023
> 
> We thought it would be best to introduce "fallthrough" and only resort
> to comments as a plan B. The usage of the keyword should allow GCC to do
> better checks.
> 
> 
> > > Define the pseudo keyword 'fallthrough' for the ability to convert the
> > > various case block /* fallthrough */ style comments to null statement
> > > "__attribute__((__fallthrough__))"
> > > 
> > > In C mode, GCC supports the __fallthrough__ attribute since 7.1,
> > > the same time the warning and the comment parsing were introduced.
> > > 
> > > fallthrough devolves to an empty "do {} while (0)" if the compiler
> > > version (any version less than gcc 7) does not support the attribute.
> > 
> > What about Coverity? It would be nice if we wouldn't need to add
> > two separate constructs everywhere to make both compiler and static
> > code checker happy.
> 
> I don't think I fully understand your reply here: Coverity doesn't come
> into the picture. Given that GCC provides a special keyword to implement
> fallthrough, it makes sense to use it when available. When it is not
> available (e.g. clang or older GCC) we need to have an alternative to
> suppress the compiler warnings. Hence the need for this check:
> 
>   #if (!defined(__clang__) && (__GNUC__ >= 7))

I forgot to mention that it matches the implementation in Linux, see
include/linux/compiler_attributes.h and 294f69e662d15.
Jan Beulich Jan. 14, 2021, 9:04 a.m. UTC | #6
On 13.01.2021 00:30, Stefano Stabellini wrote:
> On Tue, 12 Jan 2021, Jan Beulich wrote:
>> On 08.01.2021 15:46, Rahul Singh wrote:
>>> -Wimplicit-fallthrough warns when a switch case falls through. Warning
>>> can be suppress by either adding a /* fallthrough */ comment, or by
>>> using a null statement: __attribute__ ((fallthrough))
>>
>> Why is the comment variant (which we use in many places already,
>> albeit with varying wording) not the route of choice?
> 
> See previous discussion:
> 
> https://marc.info/?l=xen-devel&m=160707274517270
> https://marc.info/?l=xen-devel&m=160733742810605
> https://marc.info/?l=xen-devel&m=160733852011023
> 
> We thought it would be best to introduce "fallthrough" and only resort
> to comments as a plan B. The usage of the keyword should allow GCC to do
> better checks.

Hmm, this earlier discussion was on an Arm-specific thread, and I
have to admit I can't see arguments there pro and/or con either
of the two alternatives.

>>> Define the pseudo keyword 'fallthrough' for the ability to convert the
>>> various case block /* fallthrough */ style comments to null statement
>>> "__attribute__((__fallthrough__))"
>>>
>>> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
>>> the same time the warning and the comment parsing were introduced.
>>>
>>> fallthrough devolves to an empty "do {} while (0)" if the compiler
>>> version (any version less than gcc 7) does not support the attribute.
>>
>> What about Coverity? It would be nice if we wouldn't need to add
>> two separate constructs everywhere to make both compiler and static
>> code checker happy.
> 
> I don't think I fully understand your reply here: Coverity doesn't come
> into the picture. Given that GCC provides a special keyword to implement
> fallthrough, it makes sense to use it when available. When it is not
> available (e.g. clang or older GCC) we need to have an alternative to
> suppress the compiler warnings. Hence the need for this check:
> 
>   #if (!defined(__clang__) && (__GNUC__ >= 7))

I'm not sure how this interacts with Coverity. My point bringing up
that one is that whatever gets done here should _also_ result in
Coverity recognizing the fall-through as intentional, or else we'll
end up with many unwanted reports of new issues once the pseudo-
keyword gets made use of. The comment model is what we currently
use to "silence" Coverity; I'd like it to be clear up front that
any new alternative to be used is also going to "satisfy" it.

Jan
Stefano Stabellini Jan. 14, 2021, 11:47 p.m. UTC | #7
On Thu, 14 Jan 2021, Jan Beulich wrote:
> On 13.01.2021 00:30, Stefano Stabellini wrote:
> > On Tue, 12 Jan 2021, Jan Beulich wrote:
> >> On 08.01.2021 15:46, Rahul Singh wrote:
> >>> -Wimplicit-fallthrough warns when a switch case falls through. Warning
> >>> can be suppress by either adding a /* fallthrough */ comment, or by
> >>> using a null statement: __attribute__ ((fallthrough))
> >>
> >> Why is the comment variant (which we use in many places already,
> >> albeit with varying wording) not the route of choice?
> > 
> > See previous discussion:
> > 
> > https://marc.info/?l=xen-devel&m=160707274517270
> > https://marc.info/?l=xen-devel&m=160733742810605
> > https://marc.info/?l=xen-devel&m=160733852011023
> > 
> > We thought it would be best to introduce "fallthrough" and only resort
> > to comments as a plan B. The usage of the keyword should allow GCC to do
> > better checks.
> 
> Hmm, this earlier discussion was on an Arm-specific thread, and I
> have to admit I can't see arguments there pro and/or con either
> of the two alternatives.
> 
> >>> Define the pseudo keyword 'fallthrough' for the ability to convert the
> >>> various case block /* fallthrough */ style comments to null statement
> >>> "__attribute__((__fallthrough__))"
> >>>
> >>> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
> >>> the same time the warning and the comment parsing were introduced.
> >>>
> >>> fallthrough devolves to an empty "do {} while (0)" if the compiler
> >>> version (any version less than gcc 7) does not support the attribute.
> >>
> >> What about Coverity? It would be nice if we wouldn't need to add
> >> two separate constructs everywhere to make both compiler and static
> >> code checker happy.
> > 
> > I don't think I fully understand your reply here: Coverity doesn't come
> > into the picture. Given that GCC provides a special keyword to implement
> > fallthrough, it makes sense to use it when available. When it is not
> > available (e.g. clang or older GCC) we need to have an alternative to
> > suppress the compiler warnings. Hence the need for this check:
> > 
> >   #if (!defined(__clang__) && (__GNUC__ >= 7))
> 
> I'm not sure how this interacts with Coverity. My point bringing up
> that one is that whatever gets done here should _also_ result in
> Coverity recognizing the fall-through as intentional, or else we'll
> end up with many unwanted reports of new issues once the pseudo-
> keyword gets made use of. The comment model is what we currently
> use to "silence" Coverity; I'd like it to be clear up front that
> any new alternative to be used is also going to "satisfy" it.

That is a good point, and I agree with that. Rahul, do you have access
to a Coverity instance to run a test?
Rahul Singh Jan. 15, 2021, 12:14 p.m. UTC | #8
Hello,

> On 14 Jan 2021, at 11:47 pm, Stefano Stabellini <sstabellini@kernel.org> wrote:
> 
> On Thu, 14 Jan 2021, Jan Beulich wrote:
>> On 13.01.2021 00:30, Stefano Stabellini wrote:
>>> On Tue, 12 Jan 2021, Jan Beulich wrote:
>>>> On 08.01.2021 15:46, Rahul Singh wrote:
>>>>> -Wimplicit-fallthrough warns when a switch case falls through. Warning
>>>>> can be suppress by either adding a /* fallthrough */ comment, or by
>>>>> using a null statement: __attribute__ ((fallthrough))
>>>> 
>>>> Why is the comment variant (which we use in many places already,
>>>> albeit with varying wording) not the route of choice?
>>> 
>>> See previous discussion:
>>> 
>>> https://marc.info/?l=xen-devel&m=160707274517270
>>> https://marc.info/?l=xen-devel&m=160733742810605
>>> https://marc.info/?l=xen-devel&m=160733852011023
>>> 
>>> We thought it would be best to introduce "fallthrough" and only resort
>>> to comments as a plan B. The usage of the keyword should allow GCC to do
>>> better checks.
>> 
>> Hmm, this earlier discussion was on an Arm-specific thread, and I
>> have to admit I can't see arguments there pro and/or con either
>> of the two alternatives.
>> 
>>>>> Define the pseudo keyword 'fallthrough' for the ability to convert the
>>>>> various case block /* fallthrough */ style comments to null statement
>>>>> "__attribute__((__fallthrough__))"
>>>>> 
>>>>> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
>>>>> the same time the warning and the comment parsing were introduced.
>>>>> 
>>>>> fallthrough devolves to an empty "do {} while (0)" if the compiler
>>>>> version (any version less than gcc 7) does not support the attribute.
>>>> 
>>>> What about Coverity? It would be nice if we wouldn't need to add
>>>> two separate constructs everywhere to make both compiler and static
>>>> code checker happy.
>>> 
>>> I don't think I fully understand your reply here: Coverity doesn't come
>>> into the picture. Given that GCC provides a special keyword to implement
>>> fallthrough, it makes sense to use it when available. When it is not
>>> available (e.g. clang or older GCC) we need to have an alternative to
>>> suppress the compiler warnings. Hence the need for this check:
>>> 
>>>  #if (!defined(__clang__) && (__GNUC__ >= 7))
>> 
>> I'm not sure how this interacts with Coverity. My point bringing up
>> that one is that whatever gets done here should _also_ result in
>> Coverity recognizing the fall-through as intentional, or else we'll
>> end up with many unwanted reports of new issues once the pseudo-
>> keyword gets made use of. The comment model is what we currently
>> use to "silence" Coverity; I'd like it to be clear up front that
>> any new alternative to be used is also going to "satisfy" it.
> 
> That is a good point, and I agree with that. Rahul, do you have access
> to a Coverity instance to run a test? 

No I don’t have access to Coverity to run a test.What I found out that from the Linux kernel mailing list Coverity understand the "__attribute__((__fallthrough__))” keyword.
If someone else can run a Coverity test than it will be very helpful.

[1] https://lore.kernel.org/lkml/20181021182926.GB6683@kroah.com/
[2] https://lore.kernel.org/patchwork/patch/1108577/

Regards,
Rahul
Jan Beulich Jan. 15, 2021, 1:09 p.m. UTC | #9
On 15.01.2021 13:14, Rahul Singh wrote:
> Hello,
> 
>> On 14 Jan 2021, at 11:47 pm, Stefano Stabellini <sstabellini@kernel.org> wrote:
>>
>> On Thu, 14 Jan 2021, Jan Beulich wrote:
>>> On 13.01.2021 00:30, Stefano Stabellini wrote:
>>>> On Tue, 12 Jan 2021, Jan Beulich wrote:
>>>>> On 08.01.2021 15:46, Rahul Singh wrote:
>>>>>> -Wimplicit-fallthrough warns when a switch case falls through. Warning
>>>>>> can be suppress by either adding a /* fallthrough */ comment, or by
>>>>>> using a null statement: __attribute__ ((fallthrough))
>>>>>
>>>>> Why is the comment variant (which we use in many places already,
>>>>> albeit with varying wording) not the route of choice?
>>>>
>>>> See previous discussion:
>>>>
>>>> https://marc.info/?l=xen-devel&m=160707274517270
>>>> https://marc.info/?l=xen-devel&m=160733742810605
>>>> https://marc.info/?l=xen-devel&m=160733852011023
>>>>
>>>> We thought it would be best to introduce "fallthrough" and only resort
>>>> to comments as a plan B. The usage of the keyword should allow GCC to do
>>>> better checks.
>>>
>>> Hmm, this earlier discussion was on an Arm-specific thread, and I
>>> have to admit I can't see arguments there pro and/or con either
>>> of the two alternatives.
>>>
>>>>>> Define the pseudo keyword 'fallthrough' for the ability to convert the
>>>>>> various case block /* fallthrough */ style comments to null statement
>>>>>> "__attribute__((__fallthrough__))"
>>>>>>
>>>>>> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
>>>>>> the same time the warning and the comment parsing were introduced.
>>>>>>
>>>>>> fallthrough devolves to an empty "do {} while (0)" if the compiler
>>>>>> version (any version less than gcc 7) does not support the attribute.
>>>>>
>>>>> What about Coverity? It would be nice if we wouldn't need to add
>>>>> two separate constructs everywhere to make both compiler and static
>>>>> code checker happy.
>>>>
>>>> I don't think I fully understand your reply here: Coverity doesn't come
>>>> into the picture. Given that GCC provides a special keyword to implement
>>>> fallthrough, it makes sense to use it when available. When it is not
>>>> available (e.g. clang or older GCC) we need to have an alternative to
>>>> suppress the compiler warnings. Hence the need for this check:
>>>>
>>>>  #if (!defined(__clang__) && (__GNUC__ >= 7))
>>>
>>> I'm not sure how this interacts with Coverity. My point bringing up
>>> that one is that whatever gets done here should _also_ result in
>>> Coverity recognizing the fall-through as intentional, or else we'll
>>> end up with many unwanted reports of new issues once the pseudo-
>>> keyword gets made use of. The comment model is what we currently
>>> use to "silence" Coverity; I'd like it to be clear up front that
>>> any new alternative to be used is also going to "satisfy" it.
>>
>> That is a good point, and I agree with that. Rahul, do you have access
>> to a Coverity instance to run a test? 
> 
> No I don’t have access to Coverity to run a test.What I found out that from the Linux kernel mailing list Coverity understand the "__attribute__((__fallthrough__))” keyword.

Okay, thanks, looks sufficient afaic.

Jan

> [1] https://lore.kernel.org/lkml/20181021182926.GB6683@kroah.com/
> [2] https://lore.kernel.org/patchwork/patch/1108577/
> 
> Regards,
> Rahul
>
Stefano Stabellini Jan. 15, 2021, 5:56 p.m. UTC | #10
On Fri, 15 Jan 2021, Jan Beulich wrote:
> On 15.01.2021 13:14, Rahul Singh wrote:
> > Hello,
> > 
> >> On 14 Jan 2021, at 11:47 pm, Stefano Stabellini <sstabellini@kernel.org> wrote:
> >>
> >> On Thu, 14 Jan 2021, Jan Beulich wrote:
> >>> On 13.01.2021 00:30, Stefano Stabellini wrote:
> >>>> On Tue, 12 Jan 2021, Jan Beulich wrote:
> >>>>> On 08.01.2021 15:46, Rahul Singh wrote:
> >>>>>> -Wimplicit-fallthrough warns when a switch case falls through. Warning
> >>>>>> can be suppress by either adding a /* fallthrough */ comment, or by
> >>>>>> using a null statement: __attribute__ ((fallthrough))
> >>>>>
> >>>>> Why is the comment variant (which we use in many places already,
> >>>>> albeit with varying wording) not the route of choice?
> >>>>
> >>>> See previous discussion:
> >>>>
> >>>> https://marc.info/?l=xen-devel&m=160707274517270
> >>>> https://marc.info/?l=xen-devel&m=160733742810605
> >>>> https://marc.info/?l=xen-devel&m=160733852011023
> >>>>
> >>>> We thought it would be best to introduce "fallthrough" and only resort
> >>>> to comments as a plan B. The usage of the keyword should allow GCC to do
> >>>> better checks.
> >>>
> >>> Hmm, this earlier discussion was on an Arm-specific thread, and I
> >>> have to admit I can't see arguments there pro and/or con either
> >>> of the two alternatives.
> >>>
> >>>>>> Define the pseudo keyword 'fallthrough' for the ability to convert the
> >>>>>> various case block /* fallthrough */ style comments to null statement
> >>>>>> "__attribute__((__fallthrough__))"
> >>>>>>
> >>>>>> In C mode, GCC supports the __fallthrough__ attribute since 7.1,
> >>>>>> the same time the warning and the comment parsing were introduced.
> >>>>>>
> >>>>>> fallthrough devolves to an empty "do {} while (0)" if the compiler
> >>>>>> version (any version less than gcc 7) does not support the attribute.
> >>>>>
> >>>>> What about Coverity? It would be nice if we wouldn't need to add
> >>>>> two separate constructs everywhere to make both compiler and static
> >>>>> code checker happy.
> >>>>
> >>>> I don't think I fully understand your reply here: Coverity doesn't come
> >>>> into the picture. Given that GCC provides a special keyword to implement
> >>>> fallthrough, it makes sense to use it when available. When it is not
> >>>> available (e.g. clang or older GCC) we need to have an alternative to
> >>>> suppress the compiler warnings. Hence the need for this check:
> >>>>
> >>>>  #if (!defined(__clang__) && (__GNUC__ >= 7))
> >>>
> >>> I'm not sure how this interacts with Coverity. My point bringing up
> >>> that one is that whatever gets done here should _also_ result in
> >>> Coverity recognizing the fall-through as intentional, or else we'll
> >>> end up with many unwanted reports of new issues once the pseudo-
> >>> keyword gets made use of. The comment model is what we currently
> >>> use to "silence" Coverity; I'd like it to be clear up front that
> >>> any new alternative to be used is also going to "satisfy" it.
> >>
> >> That is a good point, and I agree with that. Rahul, do you have access
> >> to a Coverity instance to run a test? 
> > 
> > No I don’t have access to Coverity to run a test.What I found out that from the Linux kernel mailing list Coverity understand the "__attribute__((__fallthrough__))” keyword.
> 
> Okay, thanks, looks sufficient afaic.

+1
diff mbox series

Patch

diff --git a/xen/include/xen/compiler.h b/xen/include/xen/compiler.h
index e643e69128..0ec0b4698e 100644
--- a/xen/include/xen/compiler.h
+++ b/xen/include/xen/compiler.h
@@ -33,6 +33,22 @@ 
 #define unreachable() __builtin_unreachable()
 #endif
 
+/*
+ * Add the pseudo keyword 'fallthrough' so case statement blocks
+ * must end with any of these keywords:
+ *   break;
+ *   fallthrough;
+ *   goto <label>;
+ *   return [expression];
+ *
+ *  gcc: https://gcc.gnu.org/onlinedocs/gcc/Statement-Attributes.html#Statement-Attributes
+ */
+#if (!defined(__clang__) && (__GNUC__ >= 7))
+# define fallthrough        __attribute__((__fallthrough__))
+#else
+# define fallthrough        do {} while (0)  /* fallthrough */
+#endif
+
 #ifdef __clang__
 /* Clang can replace some vars with new automatic ones that go in .data;
  * mark all explicit-segment vars 'used' to prevent that. */